Vulnerabilities > CVE-2022-24796 - Unspecified vulnerability in Raspberrymatic

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

raspberrymatic

critical

NVD

Published: 2022-03-31

Updated: 2024-11-21

Summary

RaspberryMatic is a free and open-source operating system for running a cloud-free smart-home using the homematicIP / HomeMatic hardware line of IoT devices. A Remote Code Execution (RCE) vulnerability in the file upload facility of the WebUI interface of RaspberryMatic exists. Missing input validation/sanitization in the file upload mechanism allows remote, unauthenticated attackers with network access to the WebUI interface to achieve arbitrary operating system command execution via shell metacharacters in the HTTP query string. Injected commands are executed as root, thus leading to a full compromise of the underlying system and all its components. Versions after `2.31.25.20180428` and prior to `3.63.8.20220330` are affected. Users are advised to update to version `3.63.8.20220330` or newer. There are currently no known workarounds to mitigate the security impact and users are advised to update to the latest version available.

Vulnerable Configurations

Part	Description	Count
OS	Raspberrymatic Raspberrymatic Raspberrymatic 2.31.25.20180428 Raspberrymatic Raspberrymatic 2.31.25.20180526 Raspberrymatic Raspberrymatic 2.31.25.20180625 Raspberrymatic Raspberrymatic 2.35.16.20180708 Raspberrymatic Raspberrymatic 2.35.16.20180715 Raspberrymatic Raspberrymatic 2.35.16.20180826 Raspberrymatic Raspberrymatic 3.37.8.20180922 Raspberrymatic Raspberrymatic 3.37.8.20180929 Raspberrymatic Raspberrymatic 3.37.8.20181026 Raspberrymatic Raspberrymatic 3.41.11.20181124 Raspberrymatic Raspberrymatic 3.41.11.20181126 Raspberrymatic Raspberrymatic 3.41.11.20181222 Raspberrymatic Raspberrymatic 3.41.11.20190126 Raspberrymatic Raspberrymatic 3.43.15.20190223 Raspberrymatic Raspberrymatic 3.45.5.20190330 Raspberrymatic Raspberrymatic 3.45.7.20190504 Raspberrymatic Raspberrymatic 3.45.7.20190511 Raspberrymatic Raspberrymatic 3.45.7.20190622 Raspberrymatic Raspberrymatic 3.47.10.20190713 Raspberrymatic Raspberrymatic 3.47.15.20190831 Raspberrymatic Raspberrymatic 3.47.18.20190918 Raspberrymatic Raspberrymatic 3.47.22.20191026 Raspberrymatic Raspberrymatic 3.47.22.20191130 Raspberrymatic Raspberrymatic 3.49.17.20191225 Raspberrymatic Raspberrymatic 3.49.17.20200131 Raspberrymatic Raspberrymatic 3.51.6.20200229 Raspberrymatic Raspberrymatic 3.51.6.20200420 Raspberrymatic Raspberrymatic 3.51.6.20200613 Raspberrymatic Raspberrymatic 3.51.6.20200621 Raspberrymatic Raspberrymatic 3.53.30.20200919 Raspberrymatic Raspberrymatic 3.53.30.20201024 Raspberrymatic Raspberrymatic 3.53.34.20201121 Raspberrymatic Raspberrymatic 3.55.5.20201226 Raspberrymatic Raspberrymatic 3.55.10.20210213 Raspberrymatic Raspberrymatic 3.57.4.20210320 Raspberrymatic Raspberrymatic 3.57.5.20210424 Raspberrymatic Raspberrymatic 3.57.5.20210525 Raspberrymatic Raspberrymatic 3.59.6.20210703 Raspberrymatic Raspberrymatic 3.59.6.20210807 Raspberrymatic Raspberrymatic 3.59.6.20210911 Raspberrymatic Raspberrymatic 3.59.6.20211009 Raspberrymatic Raspberrymatic 3.61.5.20211113 Raspberrymatic Raspberrymatic 3.61.7.20211218 Raspberrymatic Raspberrymatic 3.61.7.20220115 Raspberrymatic Raspberrymatic 3.61.7.20220226	45

Summary

Vulnerable Configurations

References